Extracted

• • Target

    05da92735dcbd13eb4bb133a7987e1b30d54e77fbad07f0dd1321698ebbb588d.exe

  • Size

    3.0MB

  • MD5

    1ef0935e4bf01db42b4196eba194d3c4

  • SHA1

    de1fecee2a0e9094c22ac5eced05237ccb5d2d4f

  • SHA256

    05da92735dcbd13eb4bb133a7987e1b30d54e77fbad07f0dd1321698ebbb588d

  • SHA512

    a9513f1cbb13b9f76ac0a14cfc4a1cdb7ec2a1bdf18205365651851419d32e079626c9b27e44f029d01efad87c307d0e4fe1fde6d5839f6eb420af687186249f

  • SSDEEP

    49152:nKH3PgaWcZlG+VFLNNixdnmS7yvYdA6OQXp:nKH3PggZQ+3LN+dn1dd

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  behavioral1behavioral2